Connect with us

SEO

Vulnerabilities in Two ThemeForest WordPress Themes, 500k+ Sold

Published

on

Vulnerabilities in Two ThemeForest WordPress Themes, 500k+ Sold

A vulnerability advisory was issued about two WordPress themes found on ThemeForest that could allow a hacker to delete arbitrary files and inject malicious scripts into a website.

Two WordPress Themes Sold On ThemeForest

The two WordPress themes with vulnerabilities are sold on ThemeForest and together they have over a half million sales.

The two themes are:

  • Betheme theme for WordPress (306,362 sales)
  • The Enfold – Responsive Multi-Purpose Theme for WordPress (260,607 sales)

Betheme Theme for WordPress Vulnerability

Wordfence issued an advisory that The Betheme theme contained a PHP Object Injection vulnerability that was rated as a high threat.

Wordfence was discreet in their description of the vulnerability and offered no details of the specific flaw. However, in the context of a WordPress theme, a PHP Object Injection vulnerability usually arises when a user input is not properly filtered (sanitized) for unwanted uploads and inputs.

This is how Wordfence described it:

“The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the ‘mfn-page-items’ post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin.

If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.”

Has Betheme Theme Been Patched?

Betheme Theme for WordPress has received a patch on August 30, 2024. But Wordfence’s advisory isn’t acknowledging it. It’s possible that the advisory needs to be updated, not sure. Nevertheless, it’s recommended that users of the Enfold theme consider updating their theme to the newest version, which is Version 27.5.7.1.

The Enfold – Responsive Multi-Purpose Theme for WordPress

The Enfold Responsive Multi-Purpose WordPress theme contains a different flaw and was given a lower severity rating of 6.4. That said, the publisher of the theme has not issued a fix for the vulnerability.

A Stored Cross-Site Scripting (XSS) was discovered in the WordPress theme from a flaw originating in a failure to sanitize inputs.

Wordfence describes the vulnerability:

“The Enfold – Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wrapper_class’ and ‘class’ parameters in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”

Enfold Vulnerability Has Not Been Patched

The Enfold – Responsive Multi-Purpose Theme for WordPress has not been patched as of this writing and remains vulnerable. The changelog documenting the updates to the theme shows that it was last updated in August 19, 2024.

Screenshot Of Enfold WordPress Theme’s Changelog

The Enfold – Responsive Multi-Purpose Theme for WordPress has not been patched as of this writing and remains vulnerable.

Wordfence’s advisory warned:

“No known patch available. Please review the vulnerability’s details in depth and employ mitigations based on your organization’s risk tolerance. It may be best to uninstall the affected software and find a replacement.”

Read the advisories:

Betheme

Enfold

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address

SEO

Google’s AI Overviews Avoid Political Content, New Data Shows

Published

on

By

Google's AI Overviews Avoid Political Content, New Data Shows

Study reveals Google’s cautious approach to AI-generated content in sensitive search results, varying across health, finance, legal, and political topics.

  • Google shows AI Overviews for 50% of YMYL topics, with legal queries triggering them most often.
  • Health and finance AI Overviews frequently include disclaimers urging users to consult professionals.
  • Google avoids generating AI Overviews for sensitive topics like mental health, elections, and specific medications.

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

SEO

Executive Director Of WordPress Resigns

Published

on

By

WordPress Executive Director Josepha Haden Chomphosy resigns,

Josepha Haden Chomphosy, Executive Director of the WordPress Project, officially announced her resignation, ending a nine-year tenure. This comes just two weeks after Matt Mullenweg launched a controversial campaign against a managed WordPress host, which responded by filing a federal lawsuit against him and Automattic.

She posted an upbeat notice on her personal blog, reaffirming her belief in the open source community as  positive economic force as well as the importance of strong opinions that are “loosely  held.”

She wrote:

“This week marks my last as the Executive Director of the WordPress project. My time with WordPress has transformed me, both as a leader and an advocate. There’s still more to do in our shared quest to secure a self-sustaining future of the open source project that we all love, and my belief in our global community of contributors remains unchanged.

…I still believe that open source is an idea that can transform generations. I believe in the power of a good-hearted group of people. I believe in the importance of strong opinions, loosely held. And I believe the world will always need the more equitable opportunities that well-maintained open source can provide: access to knowledge and learning, easy-to-join peer and business networks, the amplification of unheard voices, and a chance to tap into economic opportunity for those who weren’t born into it.”

Turmoil At WordPress

The resignation comes amidst the backdrop of a conflict between WordPress co-founder Matt Mullenweg and the managed WordPress web host WP Engine, which has brought unprecedented turmoil within the WordPress community, including a federal lawsuit filed by WP Engine accusing Mullenweg of attempted extortion.

Resignation News Was Leaked

The news about the resignation was leaked on October 2nd by the founder of the WordPress news site WP Tavern (now owned by Matt Mullenweg), who tweeted that he had spoken with Josepha that evening, who announced her resignation.

He posted:

“I spoke with Josepha tonight. I can confirm that she’s no longer at Automattic.

She’s working on a statement for the community. She’s in good spirits despite the turmoil.”

Screenshot Of Deleted Tweet

Josepha tweeted the following response the next day:

“Ok, this is not how I expected that news to come to y’all. I apologize that this is the first many of you heard of it. Please don’t speculate about anything.”

Rocky Period For WordPress

While her resignation was somewhat of an open secret it’s still a significant event because of recent events at WordPress, including the resignations of 8.4% of Automattic employees as a result of an offer of a generous severance package to all employees who no longer wished to work  there.

Read the official announcement:

Thank you, WordPress

Featured Image by Shutterstock/Wirestock Creators

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

SEO

8% Of Automattic Employees Choose To Resign

Published

on

By

8% Of Automattic Employees Choose To Resign

WordPress co-founder and Automattic CEO announced today that he offered Automattic employees the chance to resign with a severance pay and a total of 8.4 percent. Mullenweg offered $30,000 or six months of salary, whichever one is higher, with a total of 159 people taking his offer.

Reactions Of Automattic Employees

Given the recent controversies created by Mullenweg, one might be tempted to view the walkout as a vote of no-confidence in Mullenweg. But that would be a mistake because some of the employees announcing their resignations either praised Mullenweg or simply announced their resignation while many others tweeted how happy they are to stay at Automattic.

One former employee tweeted that he was sad about recent developments but also praised Mullenweg and Automattic as an employer.

He shared:

“Today was my last day at Automattic. I spent the last 2 years building large scale ML and generative AI infra and products, and a lot of time on robotics at night and on weekends.

I’m going to spend the next month taking a break, getting married, and visiting family in Australia.

I have some really fun ideas of things to build that I’ve been storing up for a while. Now I get to build them. Get in touch if you’d like to build AI products together.”

Another former employee, Naoko Takano, is a 14 year employee, an organizer of WordCamp conferences in Asia, a full-time WordPress contributor and Open Source Project Manager at Automattic announced on X (formerly Twitter) that today was her last day at Automattic with no additional comment.

She tweeted:

“Today was my last day at Automattic.

I’m actively exploring new career opportunities. If you know of any positions that align with my skills and experience!”

Naoko’s role at at WordPress was working with the global WordPress community to improve contributor experiences through the Five for the Future and Mentorship programs. Five for the Future is an important WordPress program that encourages organizations to donate 5% of their resources back into WordPress. Five for the Future is one of the issues Mullenweg had against WP Engine, asserting that they didn’t donate enough back into the community.

Mullenweg himself was bittersweet to see those employees go, writing in a blog post:

“It was an emotional roller coaster of a week. The day you hire someone you aren’t expecting them to resign or be fired, you’re hoping for a long and mutually beneficial relationship. Every resignation stings a bit.

However now, I feel much lighter. I’m grateful and thankful for all the people who took the offer, and even more excited to work with those who turned down $126M to stay. As the kids say, LFG!”

Read the entire announcement on Mullenweg’s blog:

Automattic Alignment

Featured Image by Shutterstock/sdx15

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

Trending